install4j: Automating Windows Extended Validation Code Signing and Apple Notarization on the same machine?

Question

We are considering to switch to an extended validation (EV) code signing certificate.

In order to fully automate the notarization with Apple, we had to switch our build machine to a Mac mini.

Reading up on the EV code signing process, and how to automate it, two questions arose:

Can the password entry for the hardware token (HSM) be automated?

The comment from Ingo Kegel on this SO question seems to indicate that you can pass the HSM password via --win-keystore-password=<password> command line option.

Is that correct?

Can a multi-platform build still happen on a single machine (the Mac mini)?

The install4j help mentions 'different platforms':

On Windows, such a hardware token can be usually accessed through the Windows keystore. On a different platform, you have to choose the "Hardware security module PKCS #11 library" option and configure a native library that provides access to the keystore in the HSM through the PKCS #11 API.

Are there PKCS #11 libraries for MacOS? The library selection dialog asks for a DLL...

Answer 1

The comment from Ingo Kegel on this SO question seems to indicate that you can pass the HSM password via --win-keystore-password= command line option.

Yes, that is correct. This option is available on non-Windows platforms as well for code signing of Windows executables.

Can a multi-platform build still happen on a single machine (the Mac mini)?

Yes, a multi-platform build that involves notarization can only be performed on macOS, because Apple does not allow notarization requests except from macOS.

Are there PKCS #11 libraries for MacOS? The library selection dialog asks for a DLL...

You need a library for your HSM, this will be a .so file on Linux or a *.dylib file on macOS. I have created an issue for the file chooser to show the correct file filter based on the current platform.

Whether such a library is available for macOS depends on the HSM. These libraries are loaded by the Java Cryptography Api (JCA) and install4j has no Windows-specific code in this respect.

Answer 2

Based on Ingo Kegel's answer I had a quick look at common HSM tokens and their library support. Compiled here just for future reference (I have no way of actually testing this right now).

The USB tokens (HSM) of both DigiCert and Sectigo seem to be some version of the SafeNet eToken.

SafeNet apparently was bought by Gemalto, which in turn was bought by Thales.

Both DigiCert and Sectigo offer downloads for the SafeNet eToken drivers and authentication clients (for Window/MacOS/Linux). I couldn't find any downloads on the Thales website.

• DigiCert SafeNet Downloads
• Sectigo SafeNet Downloads

This post about signing PDF documents on MacOS Sierra using the SafeNet eToken 5100 has a screenshot showing the driver file:

/usr/local/lib/libeTPkcs11.dylib

Answer 3

I can confirm that we managed to get this running (both Windows EV Code Signing and Apple Notarization automated on a Mac mini):

• Bought Sectigo EV Code Signing Certificate
• Attached the delivered SafeNet eToken 5110 (USB Dongle) to the Mac mini
• Installed SafeNet Authentication Client (both on Mac mini and Windows for testing)
• Exported the certificate from the token to look at the certficate chain
• Exported the chain certificates from the Windows keystore (certmgr.msc)
• Imported the chain certificates onto the token (apparently some issuers will do this for you and deliver a token that not only contains the signing certificate but also it's chain)
• If the certificates cannot be added to the token, they can be provided to install4j in a directory via the compiler variable sys.ext.certDir
• Configured install4j code signing to use the PKCS11 library provided with the SafeNet Authentication Client: /usr/local/lib/libeTPkcs11.dylib
• For testing on Windows: C:/Windows/System32/eTPKCS11.dll
• Finally: No SmartScreen Message anymore